Security

The short version

• The site, the app and the weekly data run are on Fly.io in Ashburn, Virginia. The database is Convex, on AWS in N. Virginia.
• Analytics and session recordings go to PostHog's EU cloud in Frankfurt. Recordings include what you type into our forms; sign-in code fields are left out.
• Your card goes to Stripe's own checkout page, never to our servers.

Where the app and data run

These companies run parts of rebiddate. Each place below was read from our own settings and the company's own records, not assumed.

• Fly.io

  Ashburn, Virginia, US (Fly region iad)

  Runs this site, the app and the weekly data run on its servers. It sees your IP address with each request. Source: Fly.io regions (iad)

• Convex

  United States (AWS us-east-1, N. Virginia)

  Our database and file storage: your account, your metro, the emails you give us, wrong-record reports, call requests, feedback with its screenshots, which of our emails you got, opened or clicked, and your plan. Source: Convex deployment regions

• PostHog

  EU Cloud, Frankfurt, Germany (eu.i.posthog.com)

  Analytics and session recordings for the site and the app, in PostHog projects that belong to Helios One Oy. Source: PostHog data storage

• Resend

  United States (Resend region us-east-1, N. Virginia)

  Sends our emails: sign-in codes, invites, the Monday email, the four account emails (welcome, a day-7 check-in, "fixed what you reported" and trial ending) and our own alert emails. It tells us whether each one was delivered or bounced. Source: Resend regions and data storage

• Stripe

  Stripe's own systems (Helios One Oy's Stripe account)

  Takes payment on its own Checkout page and runs the billing page where you change or cancel your plan. Your card goes to Stripe, never to our servers. Source: Stripe Checkout

• Google Workspace

  Google's own data centers

  The co-founder inbox our alert emails go to: sign-ups, wrong-record reports, call requests and feedback, with what you wrote. Replies to our emails go there too.

• Tigris

  Global bucket: each file is kept near where it was written and copied to other regions when read there

  File storage for the weekly data run: our copies of the public records and each run's results. Nothing about you. Source: Tigris bucket locations (global)

The weekly data run keeps each week's results for 8 weeks. They hold public records only.

How we protect it

• Every page and request runs over HTTPS, and browsers are told never to use plain HTTP with us.
• You sign in with a one-time code sent to your email, so there's no password of yours for anyone to steal from us.
• Paying happens on Stripe's own checkout page, so your card number goes to Stripe, not to us. Source: Stripe Checkout
• Session recordings leave out the sign-in code field. They do record what you type into our other forms, like a ZIP code, an email address or a note, and they are deleted after 30 days. How recordings work.

Who is responsible

Helios One Oy, business ID 3596623-5, limited company (osakeyhtiö), Finland. Register: Finnish Trade Register (YTJ)

US mailing address: 3075 Clay St, San Francisco, CA 94115.

Email: hello@rebiddate.com

What we keep about you, and how to see it or have it deleted: Privacy policy. The rules for using rebiddate: Terms. About the public records we show: Public records.